CVE-2023-5178: Kernel: use after free in nvmet_tcp_free_crypto in nvme

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-01 · updated 2026-10-14
Weakness: CWE-416

Description

A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation.

Affected products

Linux kernel: from 5.0 before 5.4.260; from 5.5 before 5.10.199; from 5.11 before 5.15.137; from 5.16 before 6.1.60; from 6.2 before 6.5.9 — fixed in 5.10.199, 5.15.137, 5.4.260, 6.1.60, 6.5.9
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
NetApp Solidfire & Hci Management Node: all versions
NetApp Solidfire & Hci Storage Node: all versions
Red Hat Enterprise Linux: 8.0, 9.0

How to fix

Upgrade to a fixed version: Linux kernel 5.10.199, 5.15.137, 5.4.260, 6.1.60. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-5178 or the next vulnerability affects your stack